“Scattered Lapsus$ Hunters” claim to have hacked cybersecurity firm Resecurity and stolen data, but Resecurity says the hackers only accessed a decoy honeypot with fake information.
Threat actors shared screenshots on Telegram showcasing the supposed breach, asserting they had stolen employee data, internal communications, threat intelligence reports, and client information.
“We would like to announce that we have gained full access to REsecurity systems,” the group wrote on Telegram, claiming to have stolen “all internal chats and logs”, “full employee data”, “threat intel related reports”, and a “complete client list with details.”
Resecurity challenges the threat actor’s claims, asserting that the supposedly breached systems are not part of its real infrastructure but rather a honeypot intended to lure and observe the actors.
The company reported on December 24 that it first noticed a threat actor investigating its public systems on November 21, 2025.
The company filled the honeypot with fake datasets that mimic real business data, including over 28,000 synthetic consumer records and more than 190,000 synthetic payment transaction records, all created using Stripe’s official API format.
Resecurity reports that a threat actor started automating data theft in December, making over 188,000 requests from December 12 to December 24 with many residential proxy IP addresses.
Update:ShinyHunters says they were not involved in this activity as reported by Bleepingcomputer.
InfoSecBulletin Cybersecurity for mankind
